A DDoS attack is an attempt to make a computer resource unavailable to its intended users. Generally, a DDoS attack includes a concerted effort to prevent an Internet site or service from functioning. Perpetrators of DDoS attacks typically target sites or services hosted on web servers such as banks, credit card payment gateways, and even root nameservers. Improved methods and techniques to detect and mitigate DDoS attacks are needed.
Most DDoS mitigation systems use whitelists and blacklists and a combination of packet inspection to mitigate malicious traffic while minimizing impact to legitimate clients. This approach does not allow any modularity with a class of addresses. For example, in a particular request, the source IP address is not defined, blacklisted, or whitelisted. If an attack is underway, a policy may be to disallow all unknown or undefined traffic and only allow whitelisted traffic. This approach does not allow much granularity in setting traffic policies.